Overview

overview

10

Static

static

10

JaffaCakes...6d.exe

windows7-x64

1

JaffaCakes...6d.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_2ea74937f77317b5c2f1dc01fa95c2f25c54ea413d6390e8fc43af12c889076d

  • Size

    188KB

  • MD5

    71b0c015c6d93877db4ee13476f54fb5

  • SHA1

    04cbaf4e5ba0182bc494334f4c8e5f136f73491c

  • SHA256

    2ea74937f77317b5c2f1dc01fa95c2f25c54ea413d6390e8fc43af12c889076d

  • SHA512

    311a04b1d90bce390acaf05f6a1197c53fc9ba6267f00975a70acd28e84b0c55b4d8029e41873dc1532aa987fe5c23f850a0c1f97c06b3c6d02560ebd7620f30

  • SSDEEP

    3072:G5gtykeu3KB3KCO3KCFfr4SfbYgFBxc6VUBTdLysVVogTuAI6YK2lTL:F3+oKufrrfbYgFBS6GBxLysVVThkP

Score
10/10
ratid17formbook

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

id17

Decoy

speakwithjumi.com

offroadland.net

under-neat.com

elegantbreast.com

test-bh-prod-cprenrevoke01.com

xzflxxw.com

supremecuracao.com

maureenleonard.com

premier-storage-solutions.com

dawhud.direct

sherwins.xyz

considermexico.com

thebestidpro.site

albee-appliasnces.com

prospect-leadz.com

gastrokoenig.net

streetlawyerservice.com

reillykayblog.com

jkdd0.beauty

mrbright.company

Signatures

  • Formbook family
    formbook
  • Formbook payload 1 IoCs
    rat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_2ea74937f77317b5c2f1dc01fa95c2f25c54ea413d6390e8fc43af12c889076d
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections